Section 1: Security Overview Flashcards
What is Confidentiality?
Information has not been disclosed to unauthorized people (anything that mentions encryption has to do with confidentiality)
What is Integrity?
Information has not been modified or altered without proper authorization (for example, a bank teller can’t change your bank balance wily nilly; hashing)
What is availability?
Information is able to be stored, access, or protected at all times
What are the three A’s
Authentication, Authorization and Accounting
Authentication
When a person’s identity is established with proof and confirmed by a system (entering in email and password and granted access, for example)
What are the five methods of authentication?
Something you know, something you are, something you have, something you do and somewhere you are
What is authorization?
Occurs when a user is given access to a certain piece of data or certain areas of a building
What is accounting?
Tracking of data, computer usage, and network resources (usually put in a log file)
What is malware?
Short-hand term for malicious software (trojan horses, spyware, rootkits, adware, ransomware, etc.)
Unauthorized Access
Occurs when access to computer resources and data happens without the consent of the owner (guessing a password, etc.)
System Failure
When a computer crashes or system fails (BSOD, etc.)
Social Engineering
Act of manipulating users into revealing confidential information (phishing, etc.)
What are the three categories that can be used when mitigating threats?
Physical, technical, and administrative controls
Physical Controls
Alarm systems, locks, surveillance cameras, id cards, closed circuit tv
Technical Controls
Smart cards, encryption, access control lists, intrusion detection systems, and network authentication
Administrative Controls
Policies, procedures, security awareness training, contingency planning, and disaster recovery plans
What are the two categories we can further break down administrative controls?
Procedural controls and regulatory or legal controls
What is the most cost effective security control you can utilize?
User training
Administrative controls are also referred to as…
Managerial controls
What are the five types of hackers?
White hats, red hats, blue hats, gray hats, and elite
White Hat Hacker
Non-malicious hackers who attempt to break into a company’s systems at the company’s request
Black Hat Hacker
Malicious hackers who break into computer systems and networks without authorization or permission
Gray Hat Hacker
Hackers without any affiliation to a company that attempts to break into a company’s network and risks breaking the law
Blue Hat Hacker
Hackers who attempt to hack into a network with permission of the company but are not employed by the company
Elite Hackers
Hackers who find and exploit vulnerabilities before anyone else does (1 in 10,000 are elite)
What are the five kinds of threat actors?
Script Kiddies, Hacktivists, advanced persistent threats
Hacktivists
Hackers who are drive by a cause like social change, political agendas, or terrorism
Organized Crime
Hackers who are part of a crime group that is well-funded and highly sophisticated
Advanced Persistent Threats
Highly trained and funded groups of hackers (often by nation states) with covert and open-source intelligence at their disposal
What factors can we use to weigh the value of the intelligence we receive?
Timeliness, relevancy, accuracy, and confidence level
What does the MISP Project do?
Codifies the user of admiralty scale for grading data and estimative language
Where can you get information from?
Proprietary (subscription fee), Closed-Source (derived from own research or mined like FireEye), Open-Source (available without subscription)
What are Open-Source examples?
US-CERT, UK’s NCSC, ATT Security (OTX), MISP, VirusTotal, Spamhaus, SANS ISC Suspicious Domains
What is implicit knowledge?
Can only get from experienced practitioners (from experience)
What is Open Source Intelligence?
What people can find out from public records, websites and social media
Threat Hunting
Looking for threats instead of waiting for an attack
How do you do threat hunting?
Establish a hypothesis, profile threat actors and activities (create a scenario on how they’re going to do and what they might do)
What are the benefits of threat hunting?
Improve detection capabilities, integrate intelligence, reduce attack surface, block attack vectors, identify critical assets
What is the Lockheed Martin Kill Chain?
A model developed by Lockheed Martin that describes the stages by which a threat actor progresses a network intrusion
What is the MITRE ATT&CK framework?
A knowledge base maintained by the MITRE Corporation for listing and explaining specific adversary tactics, techniques, and common knowledge or procedures (attack.mitre.org)
Diamond Model of Intrusion Analysis
A framework for analyzing cybersecurity incidents and intrusions by exploring the relationships between four core features: adversary, capability, infrastructure, and victim
